cancel
Showing results for 
Search instead for 
Did you mean: 

I need to log a cookie value.

SOLVED
Highlighted
Occasional Contributor

I need to log a cookie value.

We're building a dashboard in splunk to debug some javascript for our single-page web app by sending logs via syslog.  The default logging functionality lets us log all manner of things, except for the thing we need.  The JSESSIONID is a cookie entry.  I can log a cookie with a TrafficScript, but if I do that we're logging twice for each request; once for the default logging, and once again for when our TrafficScript does a log.info().  I hollow out the log format of the default logger to cut down on noise, but the whole situation is rather inelegant.  Isn't there a cookie variable like the one for headers, like %{Key-name}k?  If not then is there some other method for adding cookie values to the log?

5 REPLIES
Contributor

Re: I need to log a cookie value.

%{Header-name}i  - The value of a named header in the HTTP request

%{Header-name}o  - The value of a named header in the HTTP response

in your case %{cookie}i %{cookie}o for requests and response

Note, in some deployments I have had the application add and use a "x-JSESSIONID" or similar header. This is easier if other cookies are involved.

Cookie request logs.JPG.jpg

Occasional Contributor

Re: I need to log a cookie value.

Thanks for responding, David.  We get the whole cookie when we do that which occassionally is huge and since we wish to disentangle JSESSIONID from all that we are using a work-around.  I set the log!format to Custom and remove all the Macro entries.  Then I have a request rule that logs what I want.  It doesn't capture response deets, but it's all we need for now.  Here's the script in case anyone is interested:

$clientIp = request.getRemoteIP();

$referer = http.getHeader('Referer');

$browser = http.getHeader('User-Agent');

$jSessionId = http.getCookie('JSESSIONID');

$path = http.getPath();

$entries = [

    $clientIp

   ,$referer

   ,$browser

   ,$jSessionId

   ,$path

];

$logString = '';

foreach($entry in $entries){

   if($entry == ''){$entry = '-';}

   $logString = $logString . ' ' . $entry;

}

log.info($logString);

Contributor

Re: Re: I need to log a cookie value.

Personally I would not want to dump application information into the general system logs with the log.info, .warn, and .error functions.

I would recommend looking into the %{Key-name}d function of the logging macro. This allows you to customize the log with the value of a key stored using the TrafficScript connection.data.set() function.


In your case, configure the logging macro for everything else you need and include:


%{JSESSIONID}d






     i.e. complete macro could read

%h %l %u %t "%r" %s %b " %{JSESSIONID}d %{Referer}i" "%{User-agent}i"


Then you will need to set the value in a request rule with Traffic Script.


$cookie = http.getCookie( "JSESSIONID" );



#JSESSION cookie data is NOT empty and JSESSION connection data = cookie data


if( $cookie != ""


   && $cookie != connection.data.get( "JSESSIONID" )


   ){


   #Set the JSESSIONID connection data


   connection.data.set( "JSESSIONID", $cookie );


   }




This will keep the application logging information in a single separate location from the Traffic Manager system information.

Occasional Contributor

Re: Re: I need to log a cookie value.

I see what you did there.  I've never used the connection data before. I'll give it a try.

Thanks!

Contributor

Re: Re: I need to log a cookie value.

sorry for the spam but I know the application can change the jsession id at various times, or if a user changes log on ID for durring the same HTTP session. If that is the case my original rule is flawed.. I have edited the reply with the correct code. Note the change in the


&& $cookie != connection.data.get( "JSESSIONID" )






This will ensure the connection data matches the cookie data.

You could also just force that on all requests with a simple one


connection.data.set( "JSESSIONID", http.getCookie( "JSESSIONID" ));



FTR,If you have to use the log route, you don't have to build the array.

i.e.


log.info(


request.getRemoteIP().


' '.http.getHeader('Referer').


' '.http.getHeader('User-Agent').


' '.http.getCookie('JSESSIONID').


' '.http.getPath() );